What is the CVSS score of CVE-2026-61961?

CVE-2026-61961 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of EmbedPress are affected by CVE-2026-61961?

EmbedPress WordPress plugin (all versions through 4.5.6) contains an unauthenticated Cross-Site Scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in user browsers…

How to fix or mitigate CVE-2026-61961?

Within 24 hours, audit all WordPress installations to identify EmbedPress version 4.5.6 and earlier; document affected sites and prepare mitigation plan. Within 7 days, implement Web Application Firewall (WAF) rules to block malicious XSS payloads, enforce Content Security Policy (CSP) headers to restrict script execution, and disable the EmbedPress plugin if functionally replaceable; notify end users not to click suspicious links referencing your WordPress sites. Within 30 days, monitor EmbedPress project for a patched version release, establish a process to patch within 48 hours of availability, and conduct security awareness training on social engineering and phishing attacks that exploit this class of vulnerability.

EmbedPress CVE-2026-61961

EUVD-2026-53957 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-fqmv-8hpc-mxxm

WordPress XSS Embedpress Wordpress Plugin Wpdeveloper

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS, no auth required, scope changes to browser; availability impact not substantiated for standard XSS behavior.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:23 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

AnalysisAI

Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.

Technical ContextAI

EmbedPress (CPE: cpe:2.3:a:wpdeveloper:embedpress:*:*:*:*:*:*:*:*) is a WordPress plugin developed by WPDeveloper that enables embedding of external content such as YouTube, Google Docs, and other media directly into posts and pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause being insufficient sanitization or escaping of user-supplied input before it is reflected back in an HTTP response. The CVSS Scope:Changed metric indicates the injected script escapes the plugin's application context and executes in the victim's browser security context, enabling access to cookies, session tokens, and DOM content for the affected site. This is consistent with a reflected XSS pattern where attacker-controlled parameters are echoed into the page without proper output encoding.

RemediationAI

The primary remediation is to update EmbedPress to a version beyond 4.5.6 via the WordPress plugin dashboard or by downloading the patched release from the WordPress plugin repository. The exact fixed version number is not confirmed in the available intelligence - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/embedpress/vulnerability/wordpress-embedpress-plugin-4-5-6-cross-site-scripting-xss-vulnerability should be consulted for the precise remediated release. If immediate patching is not feasible, a compensating control is to restrict access to the vulnerable EmbedPress-rendered endpoints to authenticated users only (via WordPress membership or access control plugins), which would eliminate the unauthenticated attack surface. Additionally, deploying a Web Application Firewall (WAF) rule targeting reflected XSS patterns in EmbedPress parameter inputs can reduce risk; note that WAF bypasses exist and this is not a substitute for patching. Administrators should also ensure WordPress Content Security Policy (CSP) headers are configured to restrict inline script execution, limiting the blast radius of any successful injection.